AwesomeREA.org

2025 · Conference paper

Beyond Classification: Inferring Function Names in Stripped Binaries via Domain Adapted LLMs

Linxi Jiang; Xin Jin; Zhiqiang Lin

SymGen infers function names for stripped binaries by generating them with a LoRA-fine-tuned Code Llama model instead of classifying over a fixed name vocabulary. Ghidra decompiles each stripped function, its own name is masked, and callee names are normalized for deduplication. Before fine-tuning, the model is domain-adapted on decompiled code paired with LLM-generated summaries of the matching source functions. On functions from 33 C projects built for x86-64, x86-32, ARM and MIPS at O0–O3, deduplicated from 2,237,915 to 495,494, the authors report average word-level F1 of 0.277 (0.380 on x86-64), plus case studies on obfuscated binaries and Linux malware.

Scope and limitations

Names are split into words and scored with precision, recall and F1, with SymLM’s CodeWordNet grouping similar words; predictions are descriptive guesses, not recovered original symbols. Average F1 is 0.277 and lower on MIPS (0.137) and ARM (0.262). The gains of up to 409.3%, 553.5% and 489.4% in the abstract are author-reported relative improvements over AsmDepictor; the baselines were retrained on the authors’ deduplicated dataset, where they score far below their own papers, and XFL was compared on x86-64 only. A separate model is trained for each architecture and optimization level. All binaries were built with GCC 9.4.0, inputs depend on Ghidra output, and Code Llama’s closed pretraining data leaves leakage possible. Obfuscation tests apply three default Hikari passes to 363 binaries from six projects (F1 0.271–0.303); the malware study covers 812 functions in 16 x86-64 builds (F1 0.348).

Why it fits this collection

Adds generative LLM-based function-name inference for stripped binaries with explicit deduplication, complementing classification-based function naming and variable, type and data-structure recovery research.

Publication and review details

Venue
NDSS 2025
Status
Conference paper
Publication / posting date
2025 (exact date not verified)
Date source
The official NDSS paper and the Internet Society’s Crossref deposit establish publication year 2025. The February 24–28 symposium dates are not used as a publication day.
DOI
10.14722/ndss.2025.240797

The NDSS page, final PDF and Crossref agree on the title, three-author order and DOI; Crossref lists no pages. The PDF marks Linxi Jiang and Xin Jin as equal-contribution first authors. SymGen is the system name and is not part of the title; an arXiv title search found no preprint. The paper links the reviewed 2025-06-05 repository snapshot, which provides Ghidra decompilation, data-processing, summary-generation, alpaca-lora-based fine-tuning, prediction and evaluation scripts, a sample dataset and a 39 MB LoRA adapter (r=8) for codellama/CodeLlama-34b-Instruct-hf; base weights are not included and keep their own terms. The paper reports about 37 hours of LoRA training on one 80 GB A100. The README uses a Python 3.9 conda environment with largely unpinned requirements, including peft installed from Git. It links Zenodo record 10.5281/zenodo.15530083 (about 7.5 GB of source projects, binaries and decompiled data; CC BY 4.0 in its metadata), whose third-party projects keep their own licenses. The README states Apache License 2.0 and LICENSE contains Apache 2.0 text after an OSU copyright header, but GitHub reports NOASSERTION; this record does not resolve that discrepancy. No code, models or datasets were run or downloaded.

Sources reviewed

Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.

Primary sources

  1. https://www.ndss-symposium.org/ndss-paper/beyond-classification-inferring-function-names-in-stripped-binaries-via-domain-adapted-llms/
  2. https://www.ndss-symposium.org/wp-content/uploads/2025-797-paper.pdf
  3. https://api.crossref.org/works/10.14722/ndss.2025.240797
  4. README.md GitHub · OSUSecLab/SymGen · Revision 78df514
  5. LICENSE GitHub · OSUSecLab/SymGen · Revision 78df514
  6. requirements.txt GitHub · OSUSecLab/SymGen · Revision 78df514
  7. lora_weights/adapter_config.json GitHub · OSUSecLab/SymGen · Revision 78df514
  8. scripts/evaluation/calculate_score.py GitHub · OSUSecLab/SymGen · Revision 78df514
  9. https://zenodo.org/records/15530083
  10. https://zenodo.org/api/records/15530083